The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in the Enterprise Manager Base Platform component :

  - A flaw exists in the Bouncy Castle Java library due to     improper validation of a point within the elliptic     curve. An unauthenticated, remote attacker can exploit     this to obtain private keys by using a series of     specially crafted elliptic curve Diffie-Hellman (ECDH)     key exchanges, also known as an 'invalid curve attack.'     (CVE-2015-7940)

  - A flaw exists in Apache MyFaces Trinidad, specifically     in the CoreResponseStateManager component, due to the     ObjectInputStream and ObjectOutputStream strings being     used directly without securely deserializing Java input.
    An unauthenticated, remote attacker can exploit this,     via a deserialization attack using a crafted serialized     view state string, to have an unspecified impact that     may include the execution of arbitrary code.
    (CVE-2016-5019)

Note that the product was formerly known as Enterprise Manager Grid Control.

The Bouncy Castle Java library before 1.51 does not validate that a point is within the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an 'invalid curve attack.'

For Debian 6 'Squeeze', this issue has been fixed in version 1.44+dfsg-2+deb6u1 of bouncycastle.

Many thanks to upstream author Peter Dettmann who reviewed the backport that we prepared.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-7940

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the Oracle iPlanet Web Server (formerly known as Sun Java System Web Server) running on the remote host is 7.0.x prior to 7.0.27 Patch 26834070. It is, therefore, affected by an unspecified vulnerability in the Network Security Services (NSS) library with unknown impact.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96777	Oracle Enterprise Manager Cloud Control Multiple Vulnerabilities (January 2017 CPU)	Nessus	Misc.	2017/1/25	2026/1/2	critical
87266	Debian DLA-361-1 : bouncycastle security update	Nessus	Debian Local Security Checks	2015/12/9	2021/1/11	medium
89298	Fedora 22 : bouncycastle-1.50-8.fc22 (2015-7d95466eda)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
106349	Oracle iPlanet Web Server 7.0.x < 7.0.27 NSS Unspecified Vulnerability (January 2018 CPU)	Nessus	Web Servers	2018/1/25	2023/4/25	critical

检测

插件搜索

critical

medium

medium

critical